5 ms·

How would this effect normal users? For 99.9% of android users I don't think matters.

qmarchi 3y ago
The impediment is that if your application is distributed via the Play Store, and is removed for some reason, another installer/store (FDroid, etc.) can't update the existing package. This means that the user can't seamlessly transition between the old and new distribution methods without fully uninstalling the app and wiping the data contained theirin.
- g-b-r 3y ago
  No, you can still provide Google your own key. The enormous problem with that change is instead that indeed you're required to provide the keys to Google, which can thus replace your app with anything else (especially, something that a court orders them to use). Anyway to switch to F-Droid you always had to reinstall the app, because they use their own signing keys (and indeed could be ordered to do the same thing as above, but it's less likely). Although, I think there actually is a mechanism to switch signatures; but if I remember well it entails signing with the new signature a version signed with the old one, so it's complex.
  - Vt71fcAqt7 3y ago
    This has changed[0] >All the years before, F-Droid created a dedicated key for each app to sign the published APKs, but now with reproducible builds F-Droid ships APKs that are signed by the upstream developer [0] https://f-droid.org/en/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html https://f-droid.org/en/2023/09/03/reproducible-builds-signin...
    - g-b-r 3y ago
      Only for reproducible builds, a lot of work has been done to encourage and facilitate them in the last years, but they're still a minority of the apps. By the way, these reproducible builds apps run a high risk of being signed with the same key that Google has
      - Vt71fcAqt7 3y ago
        >these reproducible builds apps run a high risk of being signed with the same key that Google has That's a great point. Someone should submit a request to add language to their docs[0] letting developers know about that if it doesn't exist already. I breifly looked through that page just now and didn't see it pointed out explicitly. There should also be a way to let users know. [0] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
        g-b-r 3y ago
        About the fact that Google could have the signing key, you mean? Yeah I haven't followed much F-Droid lately, I wonder if they ever realized that... I think that the project never settled on a specific security model, to be honest, and the current one is mostly the result of happenstance. And I don't know what will happen to F-Droid now that some of the most important people left.
  - g-b-r 3y ago
    > if I remember well it entails signing with the new signature a version signed with the old one, so it's complex. Wait no of course it's the opposite, specifically you sign the new certificate with the old key, if I understood it right (https://source.android.com/docs/security/features/apksigning/v3#proof-of-rotation-and-self-trusted-old-certs-structs https://source.android.com/docs/security/features/apksigning...)
buu700 3y ago
It's essentially a mandatory backdoor. It means that Google has the capability to modify application code, and there's no longer a mitigation for this attack vector available to developers. Hypothetically, Google might be compelled by a government to deploy a malicious update to an app for surveillance purposes. It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys for new apps, making new non-Google apps inherently less secure.
- lern_too_spel 3y ago
  > It means that Google has the capability to modify application code The Play Store has system signature, so it could already do that. The mitigation is on the user's side to disable the Play Store, which is where it has always been. > It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys Only if they distribute through the Play Store. The whole point of the recent lawsuit is to make it easier for anybody else to distribute apps under their own control.
  - g-b-r 3y ago
    Google having the keys of all the apps on the store make all of them subvertible. So you can reach even people without the Play Store and with degoogled systems, unless they only use apps from other sources. That's both a serious problem for not so few people, and a very useful attack avenue for law enforcement.
    - lern_too_spel 3y ago
      > So you can reach even people without the Play Store and with degoogled systems How would Google install the apps on the devices without the Play Store? Even if it somehow tricked the user into installing the app, it would require the user to approve any additional permissions that the subverted app requests.
      - g-b-r 3y ago

The impediment is that if your application is distributed via the Play Store, and is removed for some reason, another installer/store (FDroid, etc.) can't update the existing package. This means that the user can't seamlessly transition between the old and new distribution methods without fully uninstalling the app and wiping the data contained theirin.

g-b-r 3y ago
No, you can still provide Google your own key. The enormous problem with that change is instead that indeed you're required to provide the keys to Google, which can thus replace your app with anything else (especially, something that a court orders them to use). Anyway to switch to F-Droid you always had to reinstall the app, because they use their own signing keys (and indeed could be ordered to do the same thing as above, but it's less likely). Although, I think there actually is a mechanism to switch signatures; but if I remember well it entails signing with the new signature a version signed with the old one, so it's complex.
- Vt71fcAqt7 3y ago
  This has changed[0] >All the years before, F-Droid created a dedicated key for each app to sign the published APKs, but now with reproducible builds F-Droid ships APKs that are signed by the upstream developer [0] https://f-droid.org/en/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html https://f-droid.org/en/2023/09/03/reproducible-builds-signin...
  - g-b-r 3y ago
    Only for reproducible builds, a lot of work has been done to encourage and facilitate them in the last years, but they're still a minority of the apps. By the way, these reproducible builds apps run a high risk of being signed with the same key that Google has
    - Vt71fcAqt7 3y ago
      >these reproducible builds apps run a high risk of being signed with the same key that Google has That's a great point. Someone should submit a request to add language to their docs[0] letting developers know about that if it doesn't exist already. I breifly looked through that page just now and didn't see it pointed out explicitly. There should also be a way to let users know. [0] https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
      - g-b-r 3y ago
        About the fact that Google could have the signing key, you mean? Yeah I haven't followed much F-Droid lately, I wonder if they ever realized that... I think that the project never settled on a specific security model, to be honest, and the current one is mostly the result of happenstance. And I don't know what will happen to F-Droid now that some of the most important people left.
- g-b-r 3y ago
  > if I remember well it entails signing with the new signature a version signed with the old one, so it's complex. Wait no of course it's the opposite, specifically you sign the new certificate with the old key, if I understood it right (https://source.android.com/docs/security/features/apksigning/v3#proof-of-rotation-and-self-trusted-old-certs-structs https://source.android.com/docs/security/features/apksigning...)

buu700 3y ago

It's essentially a mandatory backdoor. It means that Google has the capability to modify application code, and there's no longer a mitigation for this attack vector available to developers. Hypothetically, Google might be compelled by a government to deploy a malicious update to an app for surveillance purposes. It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys for new apps, making new non-Google apps inherently less secure.

lern_too_spel 3y ago
> It means that Google has the capability to modify application code The Play Store has system signature, so it could already do that. The mitigation is on the user's side to disable the Play Store, which is where it has always been. > It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys Only if they distribute through the Play Store. The whole point of the recent lawsuit is to make it easier for anybody else to distribute apps under their own control.
- g-b-r 3y ago
  Google having the keys of all the apps on the store make all of them subvertible. So you can reach even people without the Play Store and with degoogled systems, unless they only use apps from other sources. That's both a serious problem for not so few people, and a very useful attack avenue for law enforcement.
  - lern_too_spel 3y ago
    > So you can reach even people without the Play Store and with degoogled systems How would Google install the apps on the devices without the Play Store? Even if it somehow tricked the user into installing the app, it would require the user to approve any additional permissions that the subverted app requests.
    - g-b-r 3y ago